SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?
⚠ Common exam trap
Many exam-takers confuse instance-level permissions (instance profile) with account-level permissions (service role), and they overlook that a maintenance window in the management account can target instances in member accounts only when a proper IAM service role is configured in each member account to allow cross-account Systems Manager operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM service role for Systems Manager in each member account and attach the AmazonSSMManagedInstanceCore policy.
Systems Manager requires an IAM service role in each member account to delegate permissions from the management account; the AmazonSSMManagedInstanceCore policy provides the minimum necessary permissions for SSM Agent to communicate with the Systems Manager service. Option E is correct because a maintenance window created in the management account can target instances across multiple accounts using AWS Resource Groups that are configured with cross-account resource queries, enabling centralized patch management without logging into each account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install the AWS Systems Manager Agent (SSM Agent) on each EC2 instance in all accounts.
Why it's wrong here
SSM Agent is pre-installed on most Amazon Linux AMIs.
- ✗
Enable AWS Config in all accounts to track patch compliance.
Why it's wrong here
Config is not required for patching.
- ✗
Configure the instance profile for each EC2 instance to include the AmazonSSMManagedInstanceCore policy.
Why it's wrong here
The instance profile must include the policy, but it is not automatically configured.
- ✓
Create an IAM service role for Systems Manager in each member account and attach the AmazonSSMManagedInstanceCore policy.
Why this is correct
Required for SSM to manage instances.
- ✓
Create a maintenance window in the management account and target instances using AWS Resource Groups that span accounts.
Why this is correct
Maintenance windows can target cross-account instances.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.